How Is Pentest Progress Calculated?

Overview

This article explains how pentest progress is calculated and displayed for Manual pentest in OrbitX.
Progress reflects both time spent and actual pentest work done, so it may not always increase in a perfectly straight line.

Applicability

This progress calculation applies only to pentests where:
mode = MANUAL

All other pentest modes continue to use the older legacy progress calculation.

How Pentest Progress Is Structured

Each pentest goes through multiple phases.
Every phase contributes a fixed percentage toward the total 100% pentest progress.

Phase Contribution to Total Progress

Once an pentest enters the Completed phase, progress automatically becomes 100%.

Expected Time Per Phase (Default)

These timelines are used when the customer has not set a custom deadline.

Total expected duration: approximately 15 days.

What Happens When a Customer Sets a Deadline

If the pentester or admin provides an external deadline, the system adjusts the time given to each phase proportionally.

In simple terms:
• A longer deadline gives each phase more time
• A shorter deadline makes phases move faster

The importance of each phase stays the same. Only the timelines change.

How Progress Moves Within a Phase

Progress within a phase can increase in two ways:

1. Time based progress

2. Issue based progress (only for Vulnerability Scan and Penetration Testing)

The system always shows the higher of the two.

Time Based Progress (All Phases)

Progress increases as time passes.

• When a phase is on time, progress moves smoothly
• When a phase is delayed, progress slows down intentionally

Important notes:
• Progress never reaches 100% just because time passed
• The phase must actually move forward or be completed

This prevents pentest from appearing complete without real work.

Issue Based Progress (Automated and Manual Only)

Finding issues can speed up progress in these phases.

What counts:
• Automated phase: only scanner reported issues
• Manual phase: only manually reported issues

Only issues created during that phase are counted.

Limits on Issue Based Progress

Issues can accelerate progress, but they are capped to prevent unrealistic jumps.

Maximum impact of issues on total pentest progress:
• Automated phase: up to 10%
• Manual phase: up to 20%

Even if many issues are found:
• Progress from issues will stop at the cap
• Time based progress can still continue

Why Progress May Appear Slow or Stuck

Here are common customer questions and what they usually mean:

“Progress is not moving even though time passed”
The phase has exceeded its expected timeline, so progress slows down.

“Many issues were found but progress stopped increasing”
The issue based progress cap has been reached.

“Progress suddenly jumped”
A phase was completed or the pentest moved to the next stage.

“Pentest is not reaching 100%”
The final phase has not yet been marked as Completed.

Issue Impact Varies by Asset Type

Different asset types usually have different numbers of expected issues. Because of this:
• Each issue may contribute a different amount to progress
• This keeps progress fair across Web, API, Cloud, Mobile, and more